Privacy Policy

Introduction

This policy explains what data we collect when you use cornea.clinic, why we collect it, which third parties it is shared with, and your rights regarding that data. By using the site — and particularly the booking forms or cost calculators — you agree to the practices described below.

Appointment Booking Data (Trafft)

When you book an appointment via /book or the inline booking widget on service pages, we collect the following data, used solely to confirm the appointment and follow up about it:

• Full name, phone number, email (optional)
• Selected clinic (Cairo / Erbil), service type, and time slot
• Discount code if used
• IP address and device data automatically captured by the booking provider

This data is sent to our booking management system Trafftand retained in the patient's medical file. It is also optionally cached in your browser (localStorage) to make returning bookings easier; you can clear it at any time from your browser settings.

Surgery Cost Calculators

Our calculators (LASIK, ICL, ICRS, corneal transplant, cataract, stem cell, corneal tattoo, dry eye) provide a personalized cost estimate. They collect your basic contact details (name, phone, email, country) along with the clinical inputs you enter (diagnosis details, severity, prior surgeries, etc.).

This data is sent to our contact-management platform Vbout so we can deliver the estimate and follow up about a consultation. You can request deletion of your data from Vbout at any time by contacting us.

Analytics & Advertising Tracking

We use industry-standard measurement tools to understand how visitors interact with the site and to measure ad campaign performance. The data collected includes: IP address (hashed in most pipelines), device and browser type, pages visited, click and booking events, and the traffic source (referrer / UTM / ad click ID). When you submit a booking or calculator form, we additionally send a hashed (SHA-256) copy of your email and phone number to match the conversion with the ad platform (Enhanced Conversions / CAPI):

• Google Analytics 4 (GA4) and Google Tag Manager — to measure traffic, top pages, booking events, and on-site behavior.
• Server-side GTM (sGTM) on the subdomain track.cornea.clinic — a server-side proxy on our infrastructure that receives conversion events from the browser, sanitizes them and hashes contact data (PII), then forwards them directly to ad platforms. This improves accuracy and reduces signal loss caused by script blockers and browser privacy controls (e.g. iOS).
• Google Ads with Enhanced Conversions and Microsoft (Bing) Ads — to track booking conversions via click IDs (gclid / msclkid) and send hashed contact data to improve match rates.
• Meta Pixel and Conversions API (CAPI) — to measure Facebook and Instagram ad performance, using event_id for deduplication between the browser and server events.
• TikTok Events API — to measure TikTok campaign performance via server-side events, including ttclid and hashed contact data.
• Snapchat Conversions API — to measure Snapchat campaign performance via server-side events, including sclid and hashed contact data.
• Dialora Voice Agent — an on-site voice chat assistant that captures transcript text and call duration to handle inquiries.

You can disable cookies in your browser settings or use ad blockers. Doing so will not prevent you from using the site, but it may reduce the accuracy of our analytics on our side.

WhatsApp AI Assistant (Zipchat)

We use Zipchat AI as an AI chat assistant on the clinic's official WhatsApp number +20 111 118 2081 to respond to patient inquiries 24/7 and route complex medical questions to our human team.

When you start a conversation with us, the following data is stored on the Zipchat platform for the purpose of replying to you and improving the service: your WhatsApp phone number, your WhatsApp display name, the conversation transcript, and message timestamps. Zipchat retains conversation logs in line with its own policy and may use de-identified transcripts to improve assistant accuracy.

You can request deletion of your conversation history at any time, or hand off to a human agent by typing "human" (or "موظف" in Arabic). WhatsApp itself end-to-end encrypts messages in transit per Meta's policy.

Cookies & Attribution Identifiers

When you arrive at the site from an ad or campaign, we store the attribution identifiers from the URL in first-party cookies on our domain only, for 90 days by default. These identifiers link your visit to the correct ad campaign so we can measure conversion accurately:

• gclid / gbraid / wbraid — Google Ads click identifier.
• fbclid — Meta (Facebook / Instagram) ad click identifier.
• ttclid — TikTok ad click identifier.
• sclid — Snapchat ad click identifier.
• msclkid — Microsoft (Bing) Ads click identifier.
• UTM parameters utm_source / utm_medium / utm_campaign / utm_content / utm_term — to identify the channel, campaign, and creative source.
• _ga / _ga_* — Google Analytics cookies that distinguish unique visitors (default lifetime: 2 years).
• _fbp — Meta Pixel browser identifier cookie (default lifetime: 90 days).

These cookies are the foundation that lets us attribute a booking back to the ad you saw, which in turn lets us optimize advertising spend. They are not used for any purpose outside conversion measurement and attribution, and you can clear them at any time from your browser settings.

Sharing With Third Parties

We do not sell your data. We share it only with the service providers listed above (Trafft, Vbout, Google, Meta, Microsoft, TikTok, Snapchat, Zipchat, Dialora, WhatsApp/Meta) within the limits required to operate the service and measure performance, and under data processing agreements with each provider. Your data is not shared with any external party for marketing purposes.

Security & Retention

The site runs on certified infrastructure (Google Cloud Run) and uses HTTPS encryption for all traffic. Booking data is retained in the patient's medical file throughout treatment and afterwards in line with applicable medical record requirements. Calculator data is retained in Vbout until deletion is requested. Analytics data follows each provider's default retention policies (e.g. GA4: 14 months).

Your Rights

You can at any time request access to the data we hold about you, request corrections, request full deletion, or withdraw your consent to processing for marketing purposes. Contact us via the email below and we will respond within a maximum of 30 business days.